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REMARKS 

This Application has been carefully reviewed in light of the Office Action mailed on 
September 23, 2005. Claims 1-39 are pending in the Application. Claims 1-39 were rejected 
in this Office Action. Claims 12, 13, 35, and 36 have been amended. Claim 38 has been 
cancelled. Applicants respectfully request reconsideration and favorable action in this case. 

Rejections Under 35 U.S.C. 8 102(b): 

Claims 19-27 are rejected under 35 U.S.C. 102(b) as being anticipated by U.S. Patent 
No. 5,960,170 to Eva Chen, et al. ("Chen"). Applicants respectfully traverse. Claim 19 
recites the limitation: "communicating to the sensor a desire to create a modified signature 
from a signature to be modifed." The Office Action relies on column 6, lines 41-42 of Chen 
to teach this limitation, however this reliance is misplaced. This passage of Chen states 
"continuing with a typical example, the request can be provided by client 300 in the form a 
request directed to the virus detection server 400 before proceeding with the determination of 
whether a virus is associated with the client 300." The "request" in Chen refers to a request 
for a virus scan (column 6, line 34), and not Applicants' claim 19 limitation "communicating 
to the sensor a desire to create a modified signature from a signature to be modifed." In 
addition, claim 19 recites the limitation "receiving from the sensor data indicative of 
parameters and associated values for the signature to be modified." The Office Action relies 
on column 7, lines 25-27 of Chen to teach this limitation, however this reliance is misplaced. 
This passage of Chen states: "in step 215, an initial virus detection object is produced by the 
virus detection server 400 and transmitted to the client 300. The virus detection objects 
include a program or code that the client 300 is capable of executing as well as data." 
Nowhere does this citation from Chen teach "receiving from the sensor data indicative of 
parameters and associated values for the signature to be modified." Instead, the cited passage 
of Chen teaches producing an executable virus detection object and transmitting the object to 
a client. For at least these reasons, claim 19 should be allowed, as should claims 20-27 that 
depend therefrom. 

Claims 35-39 are rejected under 35 U.S.C. 102(b) as being anticipated by U.S. 
Patent No. 6,279,113 to Vimal Vaidya ("Vaidya"). Applicants respectfully traverse. 
Independent claim 36 as amended recites "signature definitions comprising: an engine 
parameter and an associated name for the engine parameter. " The Office Action relies on 
column 9 lines 47-61 of Vaidya for teaching this limitation, however this reliance is 
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misplaced. This passage of Vaidya states that "an attack signature profile 198 can be 
represented as at least one expression 194 in combination with a signature attribute 196, 
wherein the expressions can be composed of search primitives 188, value primitives 190, and 
operators 192 ... ." The passage goes on to explain a specific example of an expression. 
However, nowhere does the passage teach a signature definition that comprises an engine 
parameter and an associated name for the engine parameter. The citation does not mention 
engines at all nor does it teach signatures comprising engine parameters. For at least this 
reason, claim 36 as amended should be allowed as should claims 37-39 that depend 
therefrom. For similar reasons, claim 35 as amended should be allowed as well. 

Rejections Under 35 ILS.C. § 103(a): 

Claims 1-6, 8, 10, 13, 28, and 31-34 have been rejected under 35 U.S.C. 103(a) as 
being unpatentable over Vaidya in view of U.S. Patent No. Re 36,417 to Alan S. Perelson 
("Perelson"). Claim 1 includes the limitation "generating, for each of the one or more 
signature definitions, an inspector instance based on the data file." The Office Action 
concedes that this limitation is not found in Vaidya and relies on column 6, lines 6-24 of 
Perelson. Applicants respectfully traverse. This section of Perelson does not address this 
limitation. Instead, the section is a set of equations used by some embodiments of Perelson 
that "describes the probablity for different configuration of the test string of the protection 
file 16 and original string 10" (column 5, lines 23-25). As a result, the citation provided by 
the Office Action does not teach the above limitation. For this reason, claim 1 should be 
allowed as should claims 2-10 that depend therefrom. 

The Office action also cites column 6, lines 6-24 of Perelson to teach the limitation, 
found in claims 13 and 28-34, of generating executable code based on signatures operable to 
detect instrusions associated with the signature. As stated above, this section of Perelson 
does not address this limitation. Instead, the section is a set of equations used by some 
embodiments of Perelson that "describes the probablity for different configuration of the test 
string of the protection file 16 and original string 10" (column 5, lines 23-25). For at least 
this reason, claims 13 and 28-34 should be allowed. 

Claims 1 1 and 14-18 have been rejected under 35 U.S.C. 103(a) as being unpatentable 
over Vaidya in view of Ziese. Claim 1 1 includes the limitation "automatically generating, for 
each of the one or more signatures defined in the default signature file, executable code 
operable to detect intrusions associated with the default signature." The Office action 
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concedes that Vaidya does not teach this limitation and relies on column 4, lines 51-56 of 
Zies. Applicants respectfully traverse. This passage of Zies states as follows: 



Proceeding to step 52, the intrusion detection sensor 26 generating 
the update event automatically connects to the sensor update server 
30 over the Internet 22. At decisional step 54, the intrusion 
detection sensor 26 automatically determines whether the sensor 
update server 30 includes an update 32 for the intrusion signatures 



Nowhere in this passage does Zies teach the limitation "automatically generating, for each of 
the one or more signatures defined in the default signature file, executable code operable to 
detect intrusions associated with the default signature." This passage of Zies instead teaches 
the generating of an update event, automatically connecting to a sensor update server over the 
Internet, and automatically determining whether the server includes an update for instrusion 
signatures. Nowhere does it teach automatically generating executable code for signatures 
defined in a default signature file as recited by claim 1 1 . For at least this reason, claim 1 1 
should be allowed, as should claims 12-18 that depend therefrom. 
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CONCLUSION 



Applicants have now made an earnest attempt to place this case in condition for 
immediate allowance. For the foregoing reasons and for other apparent reasons, Applicants 
respectfully request full allowance of all pending Claims. 

If the Examiner feels that a telephone conference or an interview would advance 
prosecution of this Application in any manner, please feel free to contact the undersigned 
attorney for Applicants. 

Applicants do not believe that any fees are due. However, the Commissioner is 
hereby authorized to charge any fees or credit any overpayments to Deposit Account No. 02- 
0384 of Baker Botts LX.P. 



Respectfully submitted, 



BAKER BOTTS L.L.P. 
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